This project shows how to work using Spring Security in a website using your database of choice, in this example, we will be using MongoDB.
To Enable Spring Security in a web project, you need a class attending these 2 requirements:
- Extends WebSecurityConfigurerAdapter
- Annotated with @EnableWebSecurity - Allows security for all endpoints
Allows to customize the authorization for your web site overriding some methods:
- configure(HttpSecurity http) - Configure routes and authorizations required.
http
.authorizeRequests()
.antMatchers("/css/*", "/js/*").permitAll()
.antMatchers("/admin/**").hasRole(ROLE_ADMIN)
.antMatchers("/user/**").hasRole(ROLE_USER)
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll()
.and()
.exceptionHandling().accessDeniedHandler(accessDeniedHandler)
- configure(AuthenticationManagerBuilder auth) - Configure from where the users are going to be retrieved.
.userDetailsService() - Specify the class implementing UserDetailsService
.inMemoryAuthentication() - Specify default users access and roles
auth
.userDetailsService(customMongoSecurityService).and()
.inMemoryAuthentication()
.withUser("user").password("password").roles(ROLE_USER).and()
.withUser("admin").password("1234").roles(ROLE_ADMIN)
Check the WebSecurityConfig class in com/github/bhrother/oauth/configuration
To create your custom service, you need to create a class that implements UserDetailsService. This interface offers only one method:
UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
This method is used by spring security to retrieve a object that implements UserDetails, in this case:
- org.springframework.security.core.userdetails.User
Check the class CustomMongoSecurityService in com/github/bhrother/oauth/services
This example is using:
- Spring Boot 1.5.4.RELEASE
- Spring Framework 4.3.9.RELEASE
- Thymeleaf 2.1.5.RELEASE
- Embedded MongoDB 1.3.1 (jirutka)
- Groovy
This project contains an Embedded gradle. In a terminal, navigate to the project folder and run:
./gradlew bootRun
On the web browser, access:
http://localhost:8080/spring-oauth
Try any of the combinations:
- User role: user/user or usermongo/usermongo
- Admin role: admin/1234 or adminmongo/adminmongo